Spring Security 问题 - 在 subjectDN 中找不到匹配模式

Question

我有一个正在尝试配置的 Spring 应用程序。我遇到了与 SSL 相关的握手问题......我想我已经解决了这些问题......现在，看起来 SSL 握手进行得很好。但是，我收到以下 spring 安全框架错误。试图了解这意味着什么以及是否必须配置其他内容。有人可以帮我理解这个错误吗？

* Connected to xxxx.example.com (35.xxx.xxx.190) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: xxx.cer
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: C=US; ST=NC; L=; O=Example Inc; CN=*.example.com
*  start date: May 25 18:24:25 2016 GMT
*  expire date: May 25 18:54:24 2019 GMT
*  issuer: C=US; O=Entrust, Inc.; OU=See www.entrust.net/legal-terms; OU=(c) 2012 Entrust, Inc. - for authorized use only; CN=Entrust Certification Authority - L1K
*  SSL certificate verify ok.
> GET /application HTTP/1.1
> Host: xxx.example.com
> User-Agent: curl/7.54.0
> Accept: */*
> 
< HTTP/1.1 500 
< Access-Control-Allow-Credentials: true
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT, PATCH
< Access-Control-Max-Age: 3600
< Access-Control-Allow-Headers: x-requested-with, content-type, authorization, X-RateLimit-App
< Access-Control-Expose-Headers: X-AUTH-REDIRECT-URL
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
< X-Frame-Options: DENY
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Fri, 07 Sep 2018 23:43:57 GMT
< Connection: close
< 
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):

{"error":"Internal Server Error","exception":"org.springframework.security.authentication.BadCredentialsException","message":"No matching pattern was found in subjectDN: CN=*.example.com, O=, L=, ST=NC, C=US","status":500,"timestamp":1536363837143}

Answer 1

事实证明这是身份提取的问题。我已经为 subject-principal-regex 给出了一个表达式。它是

EMAILADDRESS=(.*?)(?:,|$)

.. 但是客户端证书在主题 dn 中没有电子邮件地址属性.. 我不得不将 subject-principal-regex 配置更改为

CN=(.*?)(?:,|$)